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WO 99/30458 PCT/US98/25824 
TRANSFORMATION METHODS K)R OPTIMIZING 

ELLIPTIC CURVE CRYPTOGRAPHIC COMPUTATIONS 



TECHNICAL FIELD OF INVENTION 

The present invention relates to software and hardware implementation of elliptic curve 
cryptographic systems, in particular, and systems that require computation of calculations 
involving a finite number of arbitrary field operations within a finite field, in general. 



BACKGROUND OF THE INVENTION 

In the modern information-based society, the need for global computer and network 
security is becoming increasingly urgent. Cryptographic systems are fundamental tools used to 
build systems that ensure privacy, trust, and access control in such diverse areas as electronic 
commerce, corporate security, digital distribution of intellectual property, and national security, 
among others 

"Public-key" cryptographic systems, in turn, provide essential capabilities needed in 
systems requiring secure exchange of information between entities (people or computer systems) 
that may have never exchanged data with one another before. Most modern information systems, 
including the Internet, fit this description. As an example, while a consumer may have never had 
any contacts with a particular on-line vendor, he or she should be able to purchase an item from 
that vendor in a secure manner. Public-key cryptosystems enable such purchases through 
providing capabilities such as encryption, decryption, digital signatures, and signature verification. 
In public-key cryptography, an entity interested in receiving secure messages from others 
publishes his or her "public key " Others use this public-key to encrypt messages they send to the 
entity These messages can be decrypted only through the use of a "private key" which is known 
only to the entity The entity can also use this private key to digitally '"sign" a piece of data 
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Others, in turn, can use the public key to verify the signature and ascertain that the data was 
indeed signed by the signing entity 

The security of a public-key cryptosystem depends on how difficult it is to derive a private 
key from its associated, known public key The more complex it is to mathematically derive the 
5 private key, the more time it takes a computer to "break" a public key by "guessing" its 

corresponding private key Today, the most commonly used public-key cryptography system is 
the RSA public-key cryptosystem. The relationship between RSA's public and private keys is 
governed by the mathematics of factorization of large composite integers. RSA public and private 
keys are large integers represented as a binary bit pattern. The longer a key, the harder it is and 

10 the longer it takes a computer to break it by deriving its private key. For example, modern 

advances in factorization algorithms and distributed computing have made breaking 400-bit RSA 
keys possible. Breaking an RSA key of length 1024 or 2048 bits, however, is thought to be 
virtually impossible given the computing resources available today. To retain an acceptable level 
of security, modern systems have been using longer RSA keys. Since performing public-key 

1 5 cryptography using longer keys requires more computing resources, it is economically ideal to use 
an alternative public-key cryptosystem that provides the same level of security with shorter keys 
Over the last decade, Elliptic Curve Cryptography ("ECC") has emerged as one possible 
alternative for an effective cryptosystem. ECC offers the same level of security as RSA with keys 
that are one-sixth the length of RSA keys. Until now, however, existing software implementations 

2 0 of ECC have been too inefficient to be commercially viable. In order to be commercially viable, 
ECC needs to allow the same functionality as RSA at comparable speeds, as well as lower costs 
of implementation in hardware and software. Efficient ECC will enable implementation of many 
envisioned modern systems that would otherwise be economically infeasible. As such, much 
research has been focused on achieving efficient ECC in the academia and industry The most 

2 5 common approach to achieving efficient ECC is briefly described below 
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To perform public-key cryptography, ECC methods take advantage of specific features of 

mathematical "groups" called "elliptic curves " An elliptic curve is related to and "constructed 
over" a mathematical "field." Any finite field can be chosen to construct an elliptic curve, but the 
exact choice of the field significantly affects the properties of the elliptic curve and the efficiency 
5 of computer implementations that represent the "operations" defined within that elliptic curve. 
One of the most computationally intense operations used in all ECC implementations is known as 
"elliptic curve point multiplication." Point multiplication requires the computation of eP, where P 
is a "point" in the elliptic curve and e is a positive integer. This operation is central to many 
elliptic curve cryptography functions, including encryption, decryption, random number 

L 0 generation, key-exchange, digital signing, and signature verification. 

Over the last decade, a debate has been carried on in the cryptography community over 
which categories of fields provide the best choices for use with ECC. Two broad categories of 
fields, called GF(p) and GF(2 k ) have been chosen by the Institute of Electrical and Electronics 
Engineers (IEEE) as international standards for Elliptic Curve Cryptography. While most 

15 academic and commercial research today is concentrated on implementing ECC over either GF(p) 
or GF(2 ), the exact advantages or disadvantages of each choice with respect to cryptography is 
not clearly understood at this point Furthermore, both GF(p) and GF(2 k ) encompass countless 
particular individual member fields within them Each individual member field has its own 
properties that affect the computational characteristics of an ECC implementation. Furthermore, 

2 0 given a particular individual member field within GF(p) or GF(2 k ), numerous elliptic "curves" can 
be constructed over such field. The choice of the curve, too, affects the computational 
characteristics of the resulting ECC implementation. 

Prior attempts for creating efficient ECC implementations have usually been based on 
finding either specific individual member fields in GF(2 k ) or GF(p) or specific curves defined over 

2 5 such individual member fields which possess -special" mathematical or computational properties 
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These special properties would then be exploited to optimize ECC computations. This approach 
does not attempt to achieve efficient ECC across all mathematical fields. Rather, it concentrates 
on carefully choosing a particular field so that a specific mathematical or computational technique 
can be deployed to achieve efficient ECC computations. 
5 An example of this is the proposal by Agnew, et al to utilize a method called "Normal 

Basis" to achieve fast ECC in particular fields in GF(2 k ). While, most academic and industry 
research has focused on using an alternate method known as "Polynomial Basis" for fields in 
GF(2 k ), the use of Normal Basis in six particular fields within GF(2 k ) has allowed 
commercialization of a particular implementation of ECC. One disadvantage of this approach is 
"10 that key lengths are limited to the six values allowed by those particular fields. 

MATHEMATICAL BACKGROUND OF THE INVENTION 

This Section presents a list of some of the mathematical terms that are used in this 
document. Some key concepts that can be useful in following the methodology of the invention 
15 are also briefly described in this Section. The descriptions in this Section are not meant to be 
mathematically precise or rigorous. 



Sets 

A "set" is any collection of objects, including mathematical and physical objects. Often, a 
2 0 set is represented in print by enclosing a comma-separated list of the objects that make up the set 
within the curly brackets, "{" and "}" For example, let F represent the set of all non-negative 
integers smaller than 7. That set can be written as F= {0, 1, 2, 3, 4, 5, 6}. An object that belongs 
to a set is a "member" or "element" of the set In another example, F denotes the set of all 
polynomials of order 4, and p fx) represents the specific polynomial x 4 + x 2 - x + 1 . Since p(x) is a 
2 5 polynomial of order 4, thenp(x) is an element of F In mathematical shorthand,/?^ e F, where 
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the symbol "e" is commonly read as "belongs to" or 'is a member of." A particular set S is a 
"subset" of another set F if every element of the set S is also an element of the set F This is 
denoted by the shorthand notation SczF. For instance {5, 1, 3} <= {0, 1, 2, 3, 4, 5, 6} The "<=" 
symbol is read as "is a subset of" Every set is a subset of itself. Given any set S, then S <= S. 

5 

Mappings 

A "mapping" is a relationship that associates each member of a set with a particular 
member of another set. For instance, Tcan be defined as the relationship that "maps" each 
member of the set of all human beings to the integer that represents that person's age if Tom is 
10 32 years old, then T( Tom ) = 32 is written to denote the relationship that T establishes between 
the integer 32 and the human being Tom. 32 is said to be the "image" of Tom "under" the 
mapping T. 

In another example, let p be a prime number, n denote any non-negative integer, and r 
denote the integer remainder which results when n is divided by p A mathematical shorthand for 

15 this is r = n mod p. For instance, if/? = 7 and n = 15, then r = 15 mod 7=1, which is the 

remainder of 15 divided by 7, since 15 = 2 - 7 - 1 A mapping T may be constructed between the 
set of all non-negative integers N = {0, 1, 2, 3, . . } and the set/? = {0, 1, 2, 3, 4, 5, 6, 7, 8} in 
the following manner, given that p = 7 and given any non-negative integer n e N, let T(n) = r = n 
mod p. Thus, T(37) = r = 37 mod 7 = 2. Note that regardless of what value n takes, T(n) is an 

20 integer less than 7. In other words, given any n e N, then T(n) € R. By convention, T\s said to 
map the set N "into" the set R This is denoted in shorthand as T: N^R, which is read, "7" is a 
mapping from the set N into the set R" Nis referred to as the "domain" of the mapping T, while 
R is said to be the ' range" of the mapping 7 . 

The "image" of the set N under the mapping 7' is the unique subset of R where every 
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element is an image of at least one element of N In other words, if F denotes the image of N 
under 1\ then, given any element y g b\ there exists at least one element x g N, such that T(x) = 
y. Since the remainder of the division of any positive integer by 7 is one of the numbers from 0 to 
6, the image of TV under Tin the above example is the set F= {0, 1, 2, 3, 4, 5, 6} Since FaR 
5 (recall that R = {0, 1, 2, 3, 4, 5, 6, 7, 8}), and no element of Nis mapped to any element of R 
outside of/ 7 , then 7 is also a mapping from N into F In other words, T: N -> F. Since every 
member of Fis an image of some element of N under T, then Tis said to map TV "onto" F 
Sometimes, the word "transformation" is used to refer to a mapping. 

10 Set Operations 

An "ordered pair" is a mathematical notion that references pairs of objects under 
circumstances where one needs to keep track of which object is the "first" element of the pair and 
which object is the "second" element of the pair. For instance, the set of all pairs of husbands and 
wives is a set of ordered pairs, whose members can be represented by the notation fx, y), where x 

15 is an element of the set of all husbands, and^ is an element of the set of all wives. Let Xand F be 
any arbitrary sets. The "cross product" of X and Fis the set of all ordered pairs whose first 
elements come from X and whose second elements come from Y. In mathematical parlance, the 
cross product of X and Y is written aslx Y and is defined by the set of all ordered pairs (x, y), 
where x e X, andjy e Y. As an example, \etX= {0,1} and 7= {0,1,2}, then X x Y= {(0, 0), (0, 

20 1),(0, 2),(1,0),(1, 1),(1,2)} 

Given any set S, then a mapping from S xS into S can be referred to as a "binary set 
operation" defined within S (the word binary underscores the fact that each element of the 
domain of the mapping is an ordered pair ) For instance, let F= {0, 1,2, 3, 4, 5, 6} Next, 
construct a mapping T: F xF -> F as follows given any ordered pair (x. y) e F x F, where x e F 
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and y e /•', let the image of (x, yj under The the integer that is the result of calculating the 
expression fx + y) mod 7 In other words, let T( (x, y) ) = fx + y) mod 7 It is relatively 
straightforward to verify that the range of 7' is in fact the set F For example, T( (4, 6) ) = (4 + 
6) mod 7 = JO mod 7 - 3. Regardless of the value of x + y, the integer which is the result of the 
5 expression (x + y) mod 7 is the remainder of a division by 7 and therefore an integer between 0 
and 6, and a member of F. Hence, T is a binary set operation defined within F 

For the sake of convenience, when working with a given binary operation T, the construct 
T((x, y)) is often written as x • y. The symbol "•" is called the "binary operator" and is used to 
represent the binary operation T. For instance, given the above definition for T, instead of writing 
io T((4, 6)) = 3, one writes 4 ■ 6 = (4 -r 6) mod 7 = 3. Other symbols may also be used as binary 

operator symbols. Two other commonly used such symbols are + and ©. The two members of the 
set S that make up the ordered pair that a binary operation maps into another member of the set S 
are the "operands" in the operation, which, in turn, is said to "operate on" the operands. For 
example, in the equation, 4 ■ 6 = 3, the operands are 4 and 6. 

15 

Groups 

A "group" is a set G together with a binary operation "•" defined within the set G such 
that the following three conditions are satisfied: 



(i) 



Given x, y, z e G, then x ■ (y ■ z) = (x ■ y) ■ z. This is known as the associative 



20 



property of the group. 



There exists a unique element I e G, such that x ■ I = I ■ x = x, for all x e G. The 



element / is referred to as the "identity" element in G. 



(iii) 



Given any x e G, there exists an element x' ! e G, such that x • x~' -- /. The 



element x ' is referred to as the "inverse" of x under the • operation 



7 
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The • operation is referred to as the "group operation " It is the existence of the group operation • 
defined within the set G that allows G to be a group In fact, G is said to be group under the - 
operation An "Abelian" group is a group G such that given any x, y e G, then x -y = y ■ x. 

As an example of an Abelian group, consider the set F= { 1, 2, 3, 4, 5, 6} together with 
the operation - given by or defined as x -y = (x -y) mod 7 for all elements x, y e F (the second "■" 
represents the common operation of integer multiplication.) It is known that F is a group under 
this "multiplication operation " To demonstrate this, Table 1, which contains the values of x -y = 
(x -y) mod 7 for all possible combinations of elements x, y e F, is constructed below To look up 
the value of x -y using the table, locate the cell that is at the intersection of the row whose label is 
the value of x with the column whose label is the value of y. 

Table 2. The Multiplication Operation in F = {1, 2, 3, 4, 5, 6} 
Given by x ■ y = (x • y) mod 7 
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As an example, note that if x = 5 and y = 6, the table gives x -y = 2. To verify the 
accuracy of this, note that x -y =5 ■ 6 = (5 ■ 6) mod 7 = 30 mod 7 = 2. 

Given the above definitions for • and F, the task of verifying that F is a group is 
tantamount to verifying that conditions (i), (ii), and (iii) above are satisfied. 

(i) Condition (i) provides that x • (y ■ z) = (x - y) ■ z. Using x=3, y=5 and z=2, 

consider that 3 ■ (5 ■ 2) - 3 - ((5 ■ 2) mod 7) 3 ■ (JO mod 7) = 3 ■ 3 = (3 ■ 3) 
mod 7 9 mod 7 - 2; and that (3 -5) -2 ((3 ■ 5) mod 7) ■ 2 --- (15 mod 7) ■ 2 
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1 -2 -- (I -2) mod 7 - 2 mod 7 - 2. Therefore, (3 • 5) • 2 - 3 ■ (5 ■ 2). 

(ii) Table 1 demonstrates that the identity element of F under the group operation • is 
1 . For, as the table shows, x ■ J = J ■ x = J for all x e F 

(iii) Using Table 1 , the following values for the inverse, x"' ', of each element x of F 

5 (where x ■ x~' =7) can be derived: F 1 = /, 2"' = 4, 3~' = 5, 4~' = 3, 5~' - 3, and 

6' 1 - 1. 

(iv) Examining Table 1 also establishes that for all x, y e F, x -y = y x Hence, F is an 
Abelian group under the multiplication operation 

: Sometimes, the symbol + is used to denote the group operation in F In such cases, the 

i 0 inverse of any element x g F under + is denoted by -x rather than x' 1 As another example of an 
Abelian group, consider the set F= {0, 1, 2, 3, 4, 5, 6} together with the operation + given by or 
defined as x - y = (x + y) mod 7 for all elements x, y e F(the second "+" represents the common 
operation of integer addition.) It is known that F is a group under this "addition operation " To 
demonstrate this, Table 2, which contains the values of x - y = (x + y) mod 7 for all possible 
15 combinations of elements x, y e F, is constructed below. 

Table 2. The Addition Operation in F = {0, 1, 2, 3, 4, 5, 6} 
Given by x+y = (x+y) mod 7 
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As an example, note that if x - 5 and y = 6, the table gives x + y = 4. To verify the 

2 0 accuracy of this, note that x y 5 ■ 6 (5 - 6) mod 7 11 mod 7 4. 

9 
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Given the above definitions for + and T 7 , the task of verifying that F is a group is 

tantamount to verifying that conditions (i), (ii), and (iii) above are satisfied. 

(i) As an example of condition (i) holding, consider that (3 + 5) + 2 =- ((3 - 5) mod 7) 
+ 2 = (8 mod 7) + 2 = 1 + 2 = (1 - 2) mod 7 = 3 mod 7 = 3; and that 3 +(5 +2) 
= 3 + ((5 -i 2) mod 7) = 3 + (7 mod 7) = 3 + 0 = (3 + 0) mod 7 = 3 mod 7 = 3. 
Therefore, (3 + 5) + 2 = 3 + (5 + 2). 

(ii) Table 2 demonstrates that the identity element of F under the group operation - is 
0 For, as the table shows, x + 0 = 0 + x = 0 for all x <= F. 

(iii) Using Table 2, the following values for the inverse, -x, of each element x of F 
(where x - (-x) = 0) can be derived" -0 = 0, -J = 6, -2 = 5, -3 = 4, -4 = J, -5 = 
2, and -6 = 1. 

(iv) Examining Table 2 also establishes that for all x, y <= F, x + y = y ~ x Hence, F is 
an Abelian group under the addition operation 

Fields 

A "field" is a set F together with two binary set operations + and • defined within F such 
that the following conditions are met: 

(i) F is an Abelian group under the + operation. The + operation is referred to as the 
"addition operation" of the field. The identity element of the field under the 
addition operation is denoted as 0. Given any element x e F, the inverse of x under 
the addition operation of the field is denoted by -x, which is referred to as the 
"additive inverse" of x. 

(ii) If 0 were to be removed from the set F, the resulting set would be an Abelian 
group under the • operation The • operation is referred to as the "multiplication 
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operation" of the field. The identity element of the field under the multiplication 

operation is denoted as 1, which is an element of F distinct from 0. Given any 
element x e F, the inverse of x under the multiplication operation of the field is 
denoted by x~' ', which is referred to as the "multiplicative inverse" ofx. 

(iii) Given any xef, then x ■ 0 = 0 ■ x = 0 

(iv) Given any x, y, z g F, then r ■ (y + z) = (x ■ y) + (x ■ z) This is known as the 
"distributive property" of the field. 

An example of a field is the set F = {0, 1,2, 3, 4, 5, 6} together with the + operation 
defined as x + y = (x + y) mod 7 and the • operation defined as x - y = (x -y) mod 7 for all x, y e 
F. It is known that F forms a field under these addition and multiplication operations. To 
demonstrate this fact, it is necessary to show that the four conditions described above are 
satisfied. Conditions (i) and (ii) where shown to be satisfied in the previous Section. Condition 
(iii) is evident from the Table 3, below 

Table 3. The Multiplication Operation in F = {0, 1, 2, 3, 4, 5, 6} 
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As an example of condition (iv) holding, we will show that 3 ■ (5 + 6) = (3 ■ 5) + (3 ■ 6). 
Indeed, 3 ■ (5 ^ 6) = (3 ■ ((5 - 6) mod 7)) mod 7 = (3 ■ (11 mod 7)) mod 7 = (3 ■ 4) mod 7 = 12 
mod 7 = 5, while, (3 ■ 5) + (3 ■ 6) = (((3 ■ 5) mod 7) - ((3 ■ 6) mod 7)) mod 7 = ((15 mod 7) - 
(18 mod 7)) mod 7 = (1 + 4 ) mod 7 = 5 mod 7 = 5, too. 

A field F is a "finite field" if it has a finite number of elements The field F above is a 

ii 
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specific example of a family of finite fields known as GFfpj, where p is any prime number Given 

a particular prime number/?, GF(p) is defined as the set {0, 1, .... p-I} of non-negative integers 
less than p, together with the addition operation + given by integer addition mod p, and the 
multiplication operation • given by integer multiplication mod p. The field F used in the above 
5 example is the field GF(7) 



Field Arithmetic 

The mathematical concept of fields is an abstraction of the familiar "rational" number 
system. The rationals are the set of all integers together with all numbers that can be represented 

10 as a fraction whose nominator and denominator are both non-zero integers The set of all rational 
numbers can in fact be shown to be a field under the common operations of addition and 
multiplication of fractions. As such, common mathematical techniques of arithmetic have also 
been carried over to the more abstract domain of fields. Given a particular field F, mathematical 
field theory allows the writing and evaluation of "valid" arithmetic expressions and equations 

15 whose constants and variables "come from the field, " i.e. are members of F. 

For instance, consider the equation y = (2 - x) / The set of all ordered pairs fx, y) of 
rational numbers that satisfy this equation includes such elements as (0, 1), (2, 5), (4, 9), and 
(3.45, 7.9). However, since the constants in this equation, 2 and I, are also members of the field 
GF(7), the "expression" (2 ■ x) + 1 is a valid expression in GF(7), meaning that as long as the 

2 0 value that is substituted for x in the expression is a member of GF(7), it is guaranteed that the 
expression will "evaluate" to a valid member of GF(7). As such, the equation itself is a valid 
equation in GF(7), too In fact, the set of all "solutions" to this equation, i.e the set of all ordered 
pairs that satisfy the equation in GF(7), is equal to {(0, J), (J, 3), (2, 5), (3, 0), (4, 2), (5, 4), (6, 
6)}. 
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To facilitate working with more complicated expressions, a few mathematical shorthands 

are utilized in field arithmetic Given any field F, any element x e F, and any positive integer 
the expression x represents that unique element of F which results when x is multiplied by itself k 
times using the multiplication operation in F. In other words x k = x ■ x ■ ... ■ x, where there are k-1 
many - operators in the expression. By convention, x° is defined to be equal to 1 . 

Given any integer k and any element x in F, the expression kx represents that unique 
element of F which results when x is added to itself k many times using the addition operation in 
F. In other words, kx = x ■+- x -r . + x, where there are k-1 many + operators in the expression. 

Given c a constant in F and x a variable defined over F, the expression c ■ x is commonly 
written as ex. Furthermore, given x and y, any two elements of F, the expression x - (-y) is 
commonly written as x - y 

Given a field F and any element x in F, the task of computing x's additive inverse, -x, or 
x's multiplicative inverse, x~' , may be computationally intense. It is possible to view the task of 
computing the inverse of x as a set operation A "unary set operation" T defined within a set S is a 
mapping from S onto S. The word unary underscores the fact that unlike binary set operations, 
the domain of T is made up of single, individual members of S. Given any element x of S, let T 
map x to x~' In other words, let T(x) = x' ! Then T is a unary set operation. 

Given a particular field F and an integer k, a polynomial p(x) of order k defined over F is 
an expression of the form p(x) = a k x k - a i _ / x' c " / +..->- a } x + a 0 . In this definition, x is a variable in 
F, meaning that before the expression is evaluated, some particular element of F must be 
substituted for x in the expression. The particular member of F which is substituted for x is the 
value that x is "bound" to. The a,'s (0 <i <k) are known as the "polynomial coefficients" of p(x) 
and are constants in F, meaning that they are chosen before a value for x is selected, and that 
regardless of the value that x takes on. the values of the polynomial coefficients remain the same 



WO 99/30458 PCT/US98/25824 

When F - GF(2), the set of all polynomials of degree k defined over GF(2) is referred to 

as GF(2 k ) It is known that given any k greater than 1, specific addition and multiplication 
operations can be defined within GF(2 k ) in such a way so that GF(2 k ) forms a field under such 
operations. The set GF(2 k ) is the set of all polynomials of order k whose polynomial coefficients 
are either 0 or I . For instance, p(x) = x 3 - x 2 - ] is a member of GF(2*) whose polynomial 
coefficients are given by a 5 = I, a 4 = 0, a 3 = 0, a 2 = 1, a } = 0, and a 0 = I. 



Optimizing Field Arithmetic Calculations 

In addition to the fields of information security and cryptography, there are numerous 
other problems in business and science, which are either based on or utilize the mathematics of 
finite fields Computer applications dealing with such problems often need to carry out 
calculations involving finite field arithmetic. This often takes the form of evaluating a 
mathematical expression /involving a finite number of constants, variables, coefficients and 
operations defined within a finite field F. Note that variables and constants must be members of 
the field F, but coefficients may take any integer value. Coefficients, such as the 5 in the 
expression x - 5 y, are not elements of the field F, and merely represent a shorthand notation for 
repeated addition, in this case 5y = 2y + 2y^y, where 2 y = y - y. Since computational 
efficiency is of concern, we will assume that if the same quantity occurs in more than one part of 
an expression, such as (x 2 -Xi) ~' does above, each such quantity is only computed once. Also, 
without loss of generality, the expression / can and will be assumed to be in fully reduced form, in 
which all calculations in the expression that involve only constants have already been performed, 
and the resulting constants substituted into the expression. 

As an example of such an expression, let F e GF(p), let x, , x 3 , y, , y 2 be variables defined 
in F, let a be a constant that is some element from F, and define, 

14 
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f=( (ys -yO ■ (x 2 - x,) -'')■( (y 2 - a) ■ (x 2 - x,J ~' ) -x, -5 x 2 

Since the only variables and constants in the expression / are x, , x 2 , yi , y 2 and a, the expression / 
involves a finite number of field elements Furthermore, the expression/ involves four unary 
additive inversion operations to calculate -x, , -x 2 , -y, , and -a, a single unary multiplicative 
5 inversion operation to calculate (x 2 -xj ~\ three binary multiplication operations, three binary 
addition operations to calculate 5 x 2 , four binary addition operations to calculate the expressions 
in parentheses, and two binary addition operations to calculate ( . ) -xj - 5 r? . Hence, the 
expression/ involves a finite number of field operations, too Consequently, when the expression/ 
is evaluated, that is, when the calculations specified in the expression / are carried out, the result 

10 of the calculation is going to be a single element in the field F. 

Any given expression/ defined within a finite field F is usually composed of 
"subexpressions." Any part of the expression / which by itself is a valid expression in F is a 
subexpression of/. For instance, the expression s = (x 2 -xrf ~' is a valid expression in F, if both x 2 
and x, are members of F. Therefore s = (x 2 -x,) ~' is a subexpression of the expression/ = ( (y 2 - 

15 y } ) ■(x 2 -x l )~ ] ) ■( (y 2 -yi) ■(x 2 -xi)"' ) -x, -x? Some of the other subexpressions of/ are s = 
x ; , s = -y u and s = (y 2 - yi ) ■ (x 2 -x{) ~ ! Note, however, that and s = x 2 -x /y ) _/ ; -x, is not a 
subexpression of/ because s is not a valid expression in F Every expression/is a subexpression 
of itself. 

Given an expression/ defined within a finite field F, the task of evaluating the expression f 
2 0 can be computationally intense. Techniques that allow efficient calculation of such expressions in 
computer software and/or hardware may have significant business and scientific value. Given the 
exact nature of the applications such calculations occur in, different criteria may be used to 
determine what exactly constitutes an "efficient" calculation. In certain applications, it may be 
desirable to optimize calculations so that higher computation speeds are achieved In other 
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applications, it may be important to optimize for minimal use of silicon area in hardware 
implementations Still other applications may benefit from optimization that allow parallel 
computation of the calculations In particular, the inversion operation, which in the fields GF(p) 
and GF(2 k ) uses the Fermat method, is computationally very intensive. To avoid this, methods of 
formulating problems in "projective coordinates" have been developed, by Menezes and others, 
which allow calculations to be reformulated in a manner that removes the need to perform any 
inversion operations, usually at the expense of increasing the number of other operations. 

The Montgomery Algorithm 

In 1985, P. L Montgomery published an algorithm which can be used to optimize the task 
of computing an expression of the form / = a • b ■ r~\ where a, b, and r are elements of a field F 
g GF(p) and • is the multiplication operation in F. Since 1985, some work in industry and 
academia has been focused on extending the use of the Montgomery algorithm to expressions of a 
more general form than f = a ■ b ■ r~' To facilitate discussion of such efforts, this patent defines 
the term "Montgomery Canonical Form." Given a particular element r of a field F, an expression / 
in F is recursively defined to be in the Montgomery Canonical Form with respect to r as such, 

(i) An expression /is in the Montgomery Canonical Form with respect to r, if it does not 
contain any field multiplication operations and also does not contain r. That is, if no 
subexpression s exists of the form s = si ■ s 2 , where s t and s 2 are subexpressions of /. For 
example, the expression/ = (x, - x, - errand the expression / = x t are both in the 
Montgomery Canonical Form with respect to r. 

(ii) An expression /is in the Montgomery Canonical Form with respect to r, if it can be 
written in the form off f) •/ ■ /• ~\ where / and f 2 are both subexpressions of/ which 
are themselves in the Montgomery Canonical Form with respect to r Note that to 
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determine whether or not an expression is in Montgomery Canonical Form with respect to 
r, the expression is to be considered in isolation For example, the expression/ = (x, -r 
xi + x t ) ■ x, ■ r~' is in the Montgomery Canonical Form with respect to r. However, f = x, 
■ (x 2 -x 2 ) ■ r~' is not in the Montgomery Canonical Form with respect to r, since although 
is in the Montgomery Canonical Form with respect to the single factor of 
r~' cannot simultaneously be considered to be part of the subexpression (x 2 -x 2 ) ■ r~ l and 
also of the whole expression, so (x 2 ■ x 2 ) is not in the Montgomery Canonical Form with 
respect to r. 

(iii) An expression /is in the Montgomery Canonical Form with respect to r, if it can be 
written in the form of/ = (s) ~' ■ r 2 where 5 is a subexpression of / which is itself in the 
Montgomery Canonical Form with respect to r. For example, the expression/ = (x 2 -x } ) 
~ ! ■ r 2 is in the Montgomery Canonical Form with respect to r. And finally, 

(iv) The expression/ is in the Montgomery Canonical Form with respect to r, if whenever 
there exists a subexpression s off which can be written as s = s/ ■ s 2 , where Si and s 2 are 
subexpressions of/which are both in the Montgomery Canonical Form with respect to r, 
then there exists a unique subexpression s 3 of / such that s 3 = sj ■ s 2 ■ r ~ ! For example, the 
expression / -= 

(((x, - x,+x,)-x, -r~' + a) -z -r' 1 ) ■ (((x, - x, +x,)-x, ■ r~' + a) ■ z ■ r~') ■ r~ l -xj-x, 

is in the Montgomery Canonical Form with respect to r. 
Given a field F e GF(p) and an element r e F, the Montgomery algorithm can be applied 
effectively to optimize computation of any expression /in F which is in the Montgomery 
Canonical Form with respect to r. Given an arbitrary expression / then, there may be efficiencies 
gained by '■transforming" the expression /into some other expression /'(read as "f prime") which 
is in Montgomery Canonical Form During the past decade and a half, an innumerable number of 
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expressions involving a finite number of operations within finite fields in GF(p) have been 

encountered within the confines of specific applications in business and academia. In some 
instances, researchers and engineers have transformed certain such expressions into other 
expressions which are in the Montgomery Canonical Form, and which are therefore faster to 
5 compute. Until the present invention, however, no general method for transforming any arbitrary 
expression involving a finite number of field operations in GF(p) into an expression that is in 
Montgomery Canonical Form with respect to some r in GF(p) has been known 

A particular expression that is commonly encountered in business and academic 
applications involving fields in GF(p) is one of the form / = x k , where k is some positive integer 
10 and x is an element in F e GF(p). Calculating/ = x k is known as the exponentiation of x. It is well 
known that a particular "substitution technique" described in the next section in this document can 
be applied to the expression / = x k to transform it into another expression,/' which is in 
Montgomery Canonical Form with respect to some particular element /- in F. The Montgomery 
algorithm is commonly applied to the resulting expression /'to provide an efficient method for 
1 5 exponentiation of x. 

Although the Montgomery algorithm has been used for over a decade for fast 
exponentiation in GF(p), no method for extending its speed improvements to general finite field 
calculations has been available until the present invention. 

In 1998, C. K. Koc and T. Acar published an algorithm which can be used to optimize the 
2 0 task of computing an expression of the form / = a ■ b ■ r ~ ! , where a, b, and r are elements of a 
field F <e GF(2 k ) and • is the multiplication operation in F This algorithm is referred to as the 
Montgomery Algorithm in GF(2 k ). The Montgomery Algorithm in GF(2 k ) has been applied in the 
past to speed up exponentiation in GF(t) in a manner analogous to the method used for speeding 
up exponentiation in GF(p). Until the present invention, however, no method for extending the 

18 
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speed improvements of this algorithm to general finite field calculations has been available 



Substitution Technique 

This section describes a particular substitution technique that is often used to manipulate 
5 expressions involving elements and operations defined within a field F The technique involves 

replacing all instances of a specific pattern of operations and/or operands in / with another specific 
pattern As an example, let x and y represent any member of F and let a, b, c, and r be specific 
elements in F Then, if all occurrences of the pattern x • y in/ = (a ■ b) - (c ■ b) are replaced by 
the pattern x -y • r, the resulting expression /'is given by /' ' -= (a ■ b ■ r) + (c ■ b ■ r). To facilitate 
10 discussion of the technique, let s be an expression that represents the pattern that is to be 

replaced. The expression s is called the "source" expression. Let t be an expression that represents 
the pattern that s is replaced with. The expression t is called the "target" expression. The rest of 
this section describes how the current substitution technique is applied to three simple types of 
source expressions. 

%s 

Case 1 The source expression 5 involves no operators 

In this case, the source expression s is given by .? -- x, where x stands for any single 
variable within the expression / The substitution technique simply replaces all occurrences of the 
variable represented by the source expression s by the pattern given by the target expression /. 

20 

Case 2 The source expression involves a single unary operator 

In this case, the source expression is given either by s = -x or s = x~', where x stands for 
any subexpression of the expression / Here, the substitution technique calls for constructing the 
set .V of all subexpressions of / that "match" the source expression s. In other words, the set S is 

19 
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given by the set of all subexpressions s of the expression/ which are of the form s = x or s -- x~' , 

where x is itself a subexpression of / Note that given any two subexpressions off in the set S, 
one may be a subexpression of the other The substitution technique works by replacing each 
member of the set S by the corresponding pattern given by the target expression t, except that 
5 before the substitution technique is applied to any member s of the set S, it is first applied to any 
other members of S that s is a subexpression of. 

Case 3 The source expression involves a single binary operator 

In this case, the source expression is given either by s = x + y or j = x -y, where x and y 

10 stand for any subexpressions of the expression / Here, the substitution technique calls for 

constructing the set 5 of all subexpressions of / that "match" the source expression s. In other 
words, the set S is given by the set of all subexpressions s of the expression/ which are of the 
form s = x~yors=x-y, where x and y are themselves subexpressions of / Note that given any 
two subexpressions of /in the set S, one may be a subexpression of the other The substitution 

15 technique works by replacing each member of the set S by the corresponding pattern given by the 
target expression /, except that before the substitution technique is applied to any member 5 of the 
set S, it is first applied to any other members of S that j is a subexpression of. 

A substitution technique similar to this has been used in business and industry in the past in 
20 a two-step process to transform instances of simple expressions, of the form / = x k , into another 
expression /'which is in Montgomery Canonical Form. To illustrate an example, this will be 
demonstrated for the case when k = 4, which means that the expression/ is given by / = x 4 = x ■ x 
■ X ■ x = ((x ■ x) ■ x ) ■ x. 

(i) Let the source expression s be given by v x ■ y Let the target expression / be given by / 

20 
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- x -y ■ r 1 , where r is a constant in the field F. Applying the substitution technique to the 

expression/ = ((x ■ x) ■ x) ■ x yieids the expression /' - (fx ■ x ■ r 1 ) ■ x ■ r~') ■ x ■ r~ ! . 
Note that the expression/' is in the Montgomery Canonical Form, since every 
subexpression of /'enclosed in parenthesis is in the Montgomery Canonical Form with 
respect to r. Because of this, the following step can allow the Montgomery algorithm to 
be applied to efficiently calculate /' 
(ii) Let the source expression s be given by s = x, where x stands for a variable or constant in 
/. Let the target expression / be given by / = x ■ r. Applying the substitution technique to 
replace every occurrence of x with x ■ r in the expression / = ((x • x ■ r~') ■ x ■ r~ ! ) x ■ F 1 
yields the expression /' = (((x ■ r) ■ (x ■ r) ■ r~') • (x ■ r) ■ r~ ! ) ■ (x ■ r) ■ r 1 .. 
This substitution technique allows efficient computation of/ - x\ because it can be shown that 
the expression /is equivalent to/ = /' • r~'. To see this in the case k = 4, note that 
/'= (((x ■ r) ■ (x ■ r) ■ r~ ! ) ■ (x ■ r) ■ r~ l ) ■ (x ■ r) - r l 
= ((x-r-x-r-r->) -x-r-r 1 ) -x- r-r l 
= ((r ■ x ■ x ■ r ■ r~') x r- f~ l ) x ■ r ■ r~' 

= ((r - x - x ■ 1) - x ■ 1) - x ■ 1 = ((r ■ x ■ x) ■ x ) ■ x = r ■ (((x ■ x) ■ x) ■ x ) = r - x 4 
Therefore,/' • /- _/ = r ■ x 4 ■ r~' = x 4 ■ r ■ r~' = x 4 ■ 1 = x 4 - /. Since /'is in the Montgomery 
Canonical Form with respect to r, it is in general more efficient to compute f ■ r' , which itself is 
in the Montgomery Canonical Form, than it is to compute / directly. 

Elliptic Curve Groups 

An elliptic curve, G, is a mathematical group that is constructed over a specific field F, 
according to a specific set of rules that depend on the exact nature of F. In general, G is a subset 
of/-' x /•, and the operation in G is defined in terms of the field operations • and • on the 
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elements of F that constitute the ordered-pair elements of G The two most commonly studied 

classes of elliptic curves are those constructed over fields belonging to GF(p) or GF(2 k ) 



Elliptic Curves over GF(p) 

An elliptic curve over GF(p) is defined by selected parameters a and b (both members of 
GF(p)) as the set of the all ordered pairs (x, y) that are solutions to the equation/ = x 3 + ax + b, 
where x, y are members of GF(p) together with an extra point 6>, usually named as the point at 
infinity It is assumed that p is a prime number greater than 3 and a, b in GF(p) are selected such 
that 4cc - 27b 2 *0 in GF(p) It has been well established that points on the elliptic curve and O 
form an Abelian group with respect to the following point addition rules: 
Equations A 

1. 0 - 0 = 0 

2. (x, y) + 0 = (x, y) 

3. (x, y) - (x-y) - O 

4. Addition of two distinct points' (x,,y0 - fa.yd = (x3,y 3 ) 

L = (yi-yi) -(x 2 -x,r l 
x } = (L -L) -xi -x 2 
y 3 = L ■ fa -x 3 ) -yi 

5. Doubling of a point: (x,,yi) + (x u y } ) = (x 3 ,y 3 ) 
L = (3x, ■ x, - a) ■ (2y 1 )~ 1 

x 3 = (L-L) -(2x0 
y 3 = L -fa -x 3 ) -y, 

where the operations , -, - , and inverse ( _/ ) are performed in the field GF(p) The above 
rules define the method by which two points on the elliptic curve are "added" to get a third point 
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These equations will be referred to in the future as Equation A. 
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Example 

The elliptic curve equation y 2 =- x 3 - x - 1 over the field GF(23) will be illustrated. It 
turns out there are 28 points on the curve including the special point O These points are 



Point 0 




(0,1) 


and 


(0,22) 


a J) 


and 


(1,16) 


(3 JO) 


and 


(3,13) 


(4,0) 






(5,4) 


and 


(5,19) 


(6,4) 


and 


(6,19) 


(7JD 


and 


(7,12) 


(9J) 


and 


(9,16) 


(11,3) 


and 


(11,20) 


(12,4) 


and 


(12,19) 


(13,7) 


and 


(13,16) 


(17,3) 


and 


(17,20) 


(18,3) 


and 


(18,20) 


(19,5) 


and 


(19,18) 



For example, (1, 7) is on the elliptic curve because it satisfies the equation y 2 = x 3 + x + 1 
in the field GF(23) (that is, modulo 23) because 7 2 = I 3 + 1 + 1 mod 23, 49 = 3 mod 23; and 3 = 
3 mod 23. 

The point addition of (3,10) and (9,7) is computed using arithmetic modulo 23, or the field 
arithmetic of GF(23). 
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L - (7-10) ■ (9-3)-' = (-3) ■ 6~' - (-3) - 4 = -12 ~ 11 

x 3 = (11 ■ 11) -3 -9 = 121 -12 = 109 = /7 
y 3 = (7/ • ^3-/7; ) -10 = -164 = 20 

Therefore, the addition of (3,10) and (9, 7) equals (17,20). This example illustrates that the 
addition of two points on the curve using the above rules gives a third point on the curve. 

Elliptic Curves over GF(2 k ) 

A non-supersingular elliptic curve over the field GF(2 k ) is defined by the parameters a and 
b in GF(2 k ), with b * 0, as the set of solutions (x, y) to the equation/ xy = x 3 + ax 2 + b 
together with the extra point O This set of points form a group with respect to the addition rules 
Equations B 

1. O 0 = O 

2. (x,y) - 0 = (x,y) 

3. (x, y) - (x, x-ry) = O 

4. Addition of two distinct points. (x,,y,) - (x 2 ,y 2 ) = (xs,ys) 
L -= (yi - yd • ( x i *- xf' 

x 3 = (L ■ L) - L -t- Xj - x 2 ^ a 
y 3 = (L ■ (x, + x 3 )) -r x 3 +y, 

5 . Doubling of a point: (x it yi) + (x,,yi) = (x 3 ,y 3 ) 
x 3 = x, ■ x, + b ■ (xT 1 ) ■ (xf ! ) 

y3=x r -xi + (xi + y, • xf') ■ x 3 -r x 3 



Point Multiplication 

An elliptic curve cryptographic operation, whether it is an encryption, a decryption, a 



WO 99/30458 PCT/US98/25824 

signature, or a key-pass operation, always involves the computation of eP given e and P, where P 

is a point on the curve and e is a positive integer The reverse of this operation, i.e , the 
computation of e given P and eP is known to be very difficult. This is called the elliptic curve 
discrete logarithm problem, for which no efficient algorithm is currently known. 

Since the addition operation in the elliptic curve group, G, is defined using a series of field 
operations from the underlying field, F, given two points P and O in G, computation of/ 5 - O or 
P + P requires computation of a series of operations in the field. In particular, if F e GF(2 k ), the 
equations 4 above show that computation ofP-Q requires one field inversion, three field 
multiplications, and nine field additions. On the other hand, the computation ofP^P requires 
one field inversion, three field multiplications and five field additions, as demonstrated by 
equations 5 

If e is about 500 bits in length, the number of elliptic curve operations (additions and 
doublings) necessary to calculate eP can be shown to be about 750 Each elliptic curve operation 
involves several (about 15-20) finite field operations If the value of k (from F e GF(2 k )) is also 
high (MOO), these computations consume a significant amount of time, particularly in software. 
Therefore, fast hardware and software implementations of elliptic curve point multiplications are 
highly desirable in cryptography. 

The following example in GF(23) illustrates various approaches that can be taken towards 
optimizing the calculation of eP. Let e = 18 and P --= (3, 10). Then eP = 18(3,10) can be calculated 
by successively adding (3,10) to itself 18 times using group addition as defined in equation A: P 
^ P + ... - P (18 copies ofP), which requires 17 elliptic curve point addition operations. 

However, there are faster algorithms known as "exponentiation methods," one example of 
which is a "binary method," shown below, which allows 18P to be computed as 

Step \ (P) (P) -- 2P 
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Step 2 (2P) - (2P) = 4P 

Step 3 (4P) -r (4P) = 8P 
Step 4 fSPJ - (8P) - 

step 5 r^p; + w =j&p 

Thus, only 5 point additions, or group operations, are utilized The partial results as weli 
as the final results are points on the curve as illustrated below 

Step I.P + P-2P (3,10) + (3, 10) = (7, 12) 

Step 2.2P-2P = 4P (7, 12) - (7, 12) = (1 7, 3) 

Step 3. 4P - 4P = 8P (17,3) - (17,3) = (13,16) 

Step 4: - 8P = 76F (7-?. /6> - (13,16) = (5, 19) 

Step 5 16P - 2P = 18P (5,19) - (7,12) = (6,19) 

Thus, 18(3,10) is (6,19) The elliptic curve discrete logarithm problem then becomes: 
knowing (3, 10) and (6, 19) and that (6,19) is an integer multiple of (3,10), what is this integer? 
The integer used for this example is equal to 1 8 

Given the binary representation of e as e k ^e k -2...e 2 ejeo, the computation of eP can be 
accomplished using the binary method or any other M-ary method. For example, in order to 
compute O = eP, the binary method proceeds as follows 

for / = k - 1 downto 0 

Q-=Q + Q 

if e, = 1 thenO := O + P 
return O. 

Therefore, the computation of O is performed by a series of elliptic curve point doublings 
CO : Q O) and point additions (O : O ■ P) 
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SUMMARY OF THE INVENTION 

The present invention optimizes the calculation of Elliptic Curve Cryptography 
computations through a transformation method that permits the use of any elliptic curve defined 
over any field F in a secure and efficient manner. The invention includes a method and apparatus 
for producing an elliptic curve point multiplication product, O = eP. The invention utilizes an 
arbitrary integer e, and a point P on an elliptic curve group G defined over a field F, where the 
group G is a subset of the field F crossed with the field F The present invention constructs a set 
G', a mapping T from G into the set G', a mapping T~ ! from G'onto G, and an operation © 
defined on G\ such that (a) given the point P, T'(T(P) )=P, and (b) P+P = T'(P'® P% where 
P' = T(P). An elliptic curve point multiplication product O is produced by transforming the point 
P to the point P' using the mapping T, performing the operation © on the point P' to determine 
the point O' = e P', and transforming the point O' to the product O using the mapping T l . The 
product O is used in an elliptic curve cryptographic operation. 

The present invention also includes a method for optimizing the calculation of 
cryptographic operations involving arbitrary expressions in finite field arithmetic through a 
transformation method that permits the use of any field F in an efficient manner The invention 
includes a method for transforming any arbitrary finite calculation in any finite field into a 
canonical form in which other previously known algorithms can be applied, thereby achieving 
increased calculation speed and efficiency. The present invention teaches a set of transformations 
of the cryptographic calculations that allows the use of other known techniques that have only 
been applicable to certain limited special cases prior to this invention. 
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DETAILED DESCRIPTION OF THE INVENTION 

The present invention provides a method for optimizing ECC computations for any curve 
in any field through focusing on one of the most computationally intense operations used in all 
ECC implementations, known as "elliptic curve point multiplication." Point multiplication requires 
the computation of eP, where P is a point in the elliptic curve and e is a positive integer. This 
operation is central to many elliptic curve cryptography functions, including encryption, 
decryption, random number generation, key-exchange, digital signing, and signature verification. 
The present invention achieves efficient ECC by providing a methodology for optimizing the 
implementation of the elliptic curve point multiplication operation. The present invention can be 
utilized to implement ECC over any curve in any field, including all individual member fields in 
GF(p) and GF(2 k ). 

The present invention further provides a methodology for optimizing computation of 
calculations involving a finite number of arbitrary field operations within any finite field. These 
calculations play a key role in computer implementations of numerous systems, including elliptic 
curve cryptosystems. 

The present invention provides a "transformation method" which can be used to enable 
optimized implementations of elliptic curve cryptographic systems in hardware and software. 

The present invention, because it employs a reversible transformation applied to the 
elements of the elliptic group, does not in any way alter the fundamental security properties of the 
mathematical algorithm used to perform the elliptic curve cryptography. The security of the 
overall ECC algorithm is determined by the choice of elliptic curve equations, number 
representation, arithmetic algorithms and other implementation aspects As long as these choices 
are made according to reliable standards, the security of the implementation is not affected by use 
of the present invention 
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The present invention can be used in any and all potential ECC applications, ranging from 

software for secure distribution of digital products such as movies and songs to hardware chips 
embedded in consumer electronic products such as cellular phones and smart cards. The cost- 
saving potential of the present invention can significantly enhance existing commercial 
5 applications and make previously infeasible business opportunities economically viable. 

Section A 

Given G czF x F, an elliptic curve defined over the field F, the present invention provides 
an improved method to optimize the computation of eP, where e is an integer and P is an element 

ft ofG. 

The present invention includes: 

(1) construction of a set G'and a method for representation of the members of G r in 
software and/or hardware; 

(2) construction of and implementing an algorithm for a first mapping, T, from G into the 
15 set G' in software and/or hardware, 

(3) construction of and implementing an algorithm for a second mapping, T 1 , which acts 
as the inverse of T, from G'onto G, in software and/or hardware; and 

(4) construction of and implementing an algorithm, in software and/or hardware, for a set 
operation © , defined in G' For each invention, the following three conditions are satisfied: 

2 0 (i) given any P e G, then T l (T(P) ) = P; 

(ii) given any two points P and S in G, then P + S = r'(P' © S% where P' = T(P) and S' 
= T(S), and 

(iii) G\ T, ©, and T l and the corresponding algorithms are chosen such that given P,, P 2 , 
... , / > \ e G, where /V is an integer, computation of T~ ! ( T(P,) © T(P 2 ) © ... © T(I\)j is m 
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general more optimized than computation of P, - P? ~ - P\- 

In other words, the present invention computes O = eP by first transforming the given 
point P to a transformed point fusing the algorithm for the first mapping T, then calculating the 
multiple sum O' = eP'using a "transformed," more computationally optimized version of the 
elliptic curve addition operation ( © ) in the transformed domain, and finally transforming G/'back 
to O using the algorithm for the second mapping, T~' Note that satisfaction of the conditions (i) 
and (ii) above ensures that this method can be applied to any point P belonging to G 

Under certain circumstances, when G ' T, T' , and © are chosen carefully, it is possible to 
optimize computation of the point multiplication operation Depending on the number of point 
additions to be performed, the additional cost of transforming the elements of G may or may not 
outweigh the improvements due to more optimized calculations in the transformed domain G ' 

Section B 

The present invention further provides a particular method for construction of G ' T, and 
T' that can be applied to any elliptic curve group G. 

Since G is a subset of F xF, points in G can be written as ordered pairs fx, y), where x 
and y are elements of the field F. The present invention provides that a particular member r of F is 
first selected. The element r may be selected to be any member of the field F. Let / be the 
mapping from G into F x F that maps any point P = (x, y) in G to some point P' = (x\ y'J in G '. 
The present invention provides that t(P) = t((x, y)) = (x ■ r, y ■ r) = P'. Since x, y, and r are all 
members of F, so are x -r and y ■ r. The present invention provides that G 'is the image of G 
under /. In other words, G'is the set of all elements of F xT^that have a point in G mapped to 
them by / The present invention further provides that T is the transformation from G onto G 'such 
that given any point P in G", then T(P) = t(P) = P' While P' - (x\ y'J is necessarily a member F x 
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/*', it is not necessarily a point in the elliptic curve group, G P'can be obtained by computing x' - 

x ■ r and j/' = y ■ r 

Let 0 'be any element of G' Since G'aF x F, we can write 0' = (u\ v% where w'and v' 
are members of F Since G'is the image of G under /, then there must exist u and v, two elements 
5 of F, such that (u, v) e G and u'= u r and v' = v • r. Since w, v, and r are all members of the 
field F, then u = u' ■ r~ ! and v = v' • /■" / , where r _/ is the inverse of r under the multiplicative 
operation of F Therefore, one can construct an inverse transformation T 1 : G r —>Gby letting T l 
map O r ---- (it', v% any element of G', to (u' ■ r~' ', v' ■ r~') 

In formal terms, this more detailed embodiment of the present invention includes the steps 

1C of: 

(1) constructing G'as the subset of F x F which is the image of G under the mapping t: G 
—>F x F, where / is constructed by first selecting any element r of F, and then letting t( (x, y) ) = 
(x ■ r, y ■ r), where • is the multiplicative operation in F; 

(2) constructing the first mapping T: G G ' by letting T(P) = t(P), where P is any point 
15 in G; and 

(3) constructing the second mapping T~ l : G' -> G by letting T ! ( (u', v') ) = 
(u' ■ r~' , V ■ r" ! ), where (u\ v') is any element of G'. 

Given the above choices for G' 7, and T ! , it may be possible to optimize calculation of 
eP may through careful definition of a © operation in G'and careful selection of r. Certain values 
2 0 of r, for instance, may provide faster software implementations, while others may enable more 
algorithmic parallelism 

Section C 

Another detailed embodiment of the present invention applies the methods of Sections A 
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and B to the elliptic curves defined over the specific fields belonging to GF(p) In this 

embodiment, a new transformed operation © is constructed such that conditions (i), (ii), and (iii) 
in Section A are satisfied. 

The present invention includes a method for optimizing calculations of eP when F is an 
individual member field of GF(p). In this embodiment, G is an elliptic curve group over F e 
GFfpJ, and G\ T, T 1 are constructed in accordance with the method of the invention described in 
Section B, above, through choosing an arbitrary element r of F. The present invention constructs 
a "transformed" operation © in G'as follows. Given any two elements of G' (xi',y 1 r ) and (x 2 r , 
y 2 % then the present invention defines (x, ' y,') © (x 2 \ y 2 ) to be given by (x 3 'y 3 y, where 

Equations A' 

z'= (x 2 '-x,y' -r 

L'=(y 2 '-y,>) -z'-f 1 

x 3 ' = L ' ■ L ' ■ r~' —x, '—x 2 ' 

y 3 '= L' ■ (xr'-xsl ■ r~' -y,' 

Using the above definition of © for the operation of the "addition" of elements of G\ the 
present invention derives the following set of field equations for the operation of adding any 
"point" (xi',y, / ) in G'to itself: 

(x, ^y, 1 ) ® (x,',y,) = (x 3 y 3 % where 

z'= (yi'+ yiT 1 -r 2 

L'= ((x/+ xi'+xi') -xi' -r~' + a') -z' -r' ! 
x 3 ' = L' ■ L' ■ r~' —xi'-xj' 
y 3 '= L / -(x ! '-x 3 / ) -r' 1 -y,' 

It is now shown how the present invention ensures that G\ T, T' , and © together satisfy 
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conditions (i), (ii), and (iii) set forth in Section A 

(i) Let P be any point in the elliptic curve group G Then there exist some elements x and y of 
F such that P - fx, y). Then r'f T(P) ) - T ! ( Tf (x, y) ) ) = T ! ( fx ■ r, y ■ r) ) = fx ■ r ■ 
r~ ! , y ■ r ■ r~ ! ) - fx, y) = P. Therefore, Condition (i) in Section A is satisfied. 

(ii) Given any two points P and S in G, then we need to show that P - S = T~' fP r ® S% 

where P ' = T(P) and S f = T(S). Let P - fx,, y,), P' = (x, ', y,0. S = fx 2 , y 2 ), S' = (x 2 \ y 2 % 

Q ^ P - S = (xx, y 3 ) and O' = P' ^ S r = fx 3 ', y 3 % Then, applying the rules for point 

addition in the elliptic curve group given by Equations A, the coordinates of O are given 

by x 3 = L ■ L - x, - x 2 and y 3 = L • fx, - x 3 ) - y,, where L = fy 2 -y,) ■ z, and z = (x, - X/j - ' 

Equations A' above, on the other hand, give the coordinates for O' As such, it can be 

shown that, 

z' =fx 2 '-x J T 1 -r 2 
= fx 2 ■ r - x, ■ r) 1 -r 2 
= fx 2 - x,)-' ■ r 
= z ■ r 

L' = fyi'-yi') -z'-r' 

= fa -r-yi - r) ■ (z -r) ■ r' ! 
= fa -yd -z-r 
= L-r 

x 3 ' = L ' ■ L ' ■ r~ ! - x, ' - x 2 ' 

= (L ■ r) ■ (L ■ r) ■ r~' - x, ■ r - x 2 ■ r 
= (L ■ L - x, - x 2 ) ■ r 
= x 3 ■ r 

y 3 '= L' ■ fx, ' - x 3 / ) ■ r 1 -y,' 

= (L ■ r) ■ fx, ■ r - x 3 ■ r) -r~' -y,-r 
= (L ■(x,-x 3 )-y l ) -r 
= y 3 -r 

Therefore, (x 3 \ y 3 J = fx 3 ■ r, y 3 ■ r), which implies that P' ®S' = TfP - S), as required. 
Hence, Condition (ii) in Section A is satisfied 
(iii) The present invention has provided a method for the selection of G' T, ©, and T ! and 
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their corresponding algorithms in a manner such that given P„ P 2 , ... , P.\ e G, where Nls 

an integer, computation of T~' ( T(P ',) © T(P 2 ) © ... © T(P^)) is in general more 
optimized than computation of P, ~ P 2 - ^ Pn To verify this, note that calculation of 
T(P,) © T(P 2 ) © ... © T(Pyj) involves repeated application of the expressions in 
5 Equations A' Note, however, that these expressions are in the Montgomery Canonical 

Form with respect to r. As such, the Montgomery Algorithm in GF(p) can be readily 
applied to the calculation of T(PJ ® T(P 2 ) © ... © T(P W ) to create an optimized 
hardware and/or software implementation Therefore, Condition (ii) in Section A is 
satisfied 

10 

Section D 

Another detailed embodiment of the present invention applies the methods of Sections A 
and B to the elliptic curves defined over the specific fields belonging to GF(2 k ) In this 
embodiment, a new transformed operation © is constructed such that conditions (i), (ii), and (iii) 

15 in Section A are satisfied. 

The present invention further includes a method for optimizing calculations of eP when F 
is an individual member field of GF(2 k ). In this embodiment, G is an elliptic curve group over F e 
GF(2 k ), and G' T, T~ ! are constructed in accordance with the method of the invention described 
in Section B, above, through choosing an arbitrary element r of F. The present invention 

2 0 constructs a "transformed" operation © in G 'as follows. Given any two elements of G ' say (x, ' 
y, ') and (x 2 \ y 2 '), then the present invention defines (x, ' yj) © (x 2 \ y 2 ') to be given by (x 3 ', y 3 / ), 
where 

Equations B r 

z' fx/ x 2 T' -r 
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L' -(>'!' ■ y?0 -z'-r' 

x 3 ' =- (L' ■ L' ■ r' ) ^- L' + x/ > x/ + a' 
y 3 ' = (L' ■ fa'+ x 3 ') - r-'j^xZ+y,' 

Using the above definition of © for the operation of the addition of points in G' the 
5 present invention derives the following set of field equations for the operation of "doubling a 
point", i.e. adding a point (x } ' y/j in G'to itself. 
(x, \ yj 0 © (x, ',y, 0 = fa' y 3 % where 
z'=(x,')- 1 • r 2 

x 3 ' = X; ' • X; ' • r _/ - (z ' ■ z ' ■ r~' ) ■ b ' ■ r~' 
: ;|o y 3 '= x,'-x,'-r~ J - fa' ^ y ; ' -z'-r" 1 ) -x 3 ' ■ r~ ! - x 3 ' 

It is now shown how the present invention ensures that G', T, T" ', and © together satisfy 
conditions (i), (ii), and (iii) set forth in Section A 

(i) Let P be any point in the elliptic curve group G. Then there exist some elements x and y of 
15 FsuchthatP - fay). Then r' ( T(P) ) = T' ( T( fa y) ) ) = T~ ! ( (x ■ r, y ■ r) ) = (x ■ r ■ 

r~', y ■ r ■ r~') = ( x, y) = P. Therefore, Condition (i) in Section A is satisfied. 

(ii) Given any two points P and S in G, then we need to show that P + S = T~'(P' © SO, 
where P' ■= T(P) and S' = T(S). Let P = fa, y,), P'=fa',yj9,S = fa, y 2 ), S' = fa', y 7 0, 
Q=P J -S = (x 3 ,y 3t )andQ'=P'+S' = fa', y 3 'J. Then, applying the rules for point 

2 0 addition in the elliptic curve group given by Equations A, the coordinates of O are given 

by x 3 = L - L ~ L + x, + x 3 ~ a and y 3 = L - (x, - x 3 ) + x 3 -r where Z, = - y 2 ) ■ z, 
and 2 = fx, - x 2 f' Equations A' above, on the other hand, give the coordinates for 0'. As 
such, it can be shown that, 
z' fx, ' ■ x 2 ' y 1 ■ r 2 
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- (x, ■ *2j-' r 



= (yi -r - y 2 ■ r) • (z ■ r) ■ r' 1 

= (yi t yd -2 r 

=-L-r 

x 3 ' = L' -U ■ r~ ! - L ' + Xj ' - x 2 ' ^ a ' 

--- (L ■ r) ■ (L ■ r) ■ r~' - L ■ r - x, ■ r - x 2 ■ r - a' ■ r 
= (L ■ L -r L -f x, + x 2 + a 'J ■ r 
-- xj • r 

^j'= L'-(x,'^ XjO -r ! - x 2 ' '-r >/,' 

= (L -r) -(x,r-r xj • r~ ; - x, • r _y, • /■ 
= (L ■ (x, t Xi) + x 3 t y, ) -r 
= y 3 -r 

Therefore, we have (x 3 ',y 3 r ) = (x 3 ■ r, y 3 ■ r) which implies that P' ® S' = T(P S), as 
required. Hence, Condition (ii) in Section A is satisfied, 
(iii) The present invention has provided a method for the selection of G' T, ©, and T 1 and 

their corresponding algorithms in a manner such that given P h P 2 , ... , P N e G, where vVis 
an integer, computation of T l ( T(PJ © T(P 2 ) © ... © T(P N )) is in general more 
optimized than computation ofP } P 2 ■+• ... ^ P_ w . To verify this, note that calculation of 
T(P,) © T(P 2 ) © ... © T(P N ) involves repeated application of the expressions in 
Equations B'. Note, however, that these expressions are in the Montgomery Canonical 
Form with respect to r. As such, the Montgomery Algorithm in GF(2 k ) can be readily 
applied to the calculation of T(P,) © T(P 2 ) © ... © T(P N ) to create an optimized 
hardware and/or software implementation. Therefore, Condition (ii) in Section A is 
satisfied. 

Section E 

The present invention further provides a method for achieving higher efficiencies when 
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utilizing the methods of Sections C and D above by providing specific choices of r 

The present invention works with any element r in the field F over which the elliptic curve 
group G is defined. The exact choice of the element r, however, affects the computational 
characteristics of the resulting calculations. The present invention teaches that the selection of r 
can optimize specific aspects of a software and/or hardware implementation within specific 
computer environments For instance, choosing r to be a multiple of 32 can have beneficial effects 
on 32-bit computers Given a particular selection of r, the calculation of a ■ b ■ r~' may be done in 
more than one way, some of which may be more computationally efficient. The following 
selections of r are preferred. 

1 Field GF(p) r is selected as the smallest power of 2 that is larger than p 

2. Field GF(p) r can be selected as the product of k prime numbers, which gives the 
resulting algorithm a high degree of parallelism. 

3. Field GF(2 k ) r is selected as x k mod n(x), where n(x) is the irreducible polynomial 
generating the field GF(2 k ) 

Other selections of r for different fields are also possible. The transformation algorithms 
work independently of this selection. 



Section F 

The present invention further provides a method for optimizing calculation of a finite 
number of arbitrary field operations over any finite field. Let/be a valid expression defined within 
F involving a finite number of variables, and a finite number of the field operations - , • , - and 
The present invention provides a method for optimizing computation of/, which includes 
carrying out the following steps in sequence 

(1 ) Select /• to be any single element of the field F The element /-, a constant, will be used to 
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transform the expression / into a new expression /'through applying a series of 

substitutions in accordance with the substitution technique described earlier in this 
document. If the expression / already contains a constant or variable denoted by the 
symbol r, then rename the symbol r in this step-by-step procedure to some unique value, 
and interpret the subsequent steps of this procedure as if r were renamed appropriately in 
them. Note that the expression / may coincidentally contain constants or variables that 
may have the same field value as the selected element r, without affecting this procedure. 
Subsequent steps of this procedure will rely on the expression /being initially free of 
"primed" symbols such as d' or j " If the expression /initially contains any variables or 
constants which are denoted by "primed" symbols, then replace each primed variable or 
constant symbol with a unique unprimed name. Subsequent substitution steps of this 
procedure will employ source expressions containing primed symbols, which by 
convention in this patent are not allowed to match symbols that are not primed Note that 
source expressions containing unprimed symbols, such as x, are allowed by convention in 
this patent to match variable symbols or constant symbols which may be either primed or 
unprimed. 

(2) Transform the expression/ into the expression // by replacing ail occurrences of the source 
expression x with the target expression x '. In this substitution, x denotes a variable or 
constant occurring in the expression / This replaces all variables and constants with 
primed symbols. Note that this occurs without affecting any coefficients that may exist in 
the expression/ 

(3) Transform the expression// into the expression /? by replacing all occurrences of the 
source expression x -y with the target expression x ®y. In this substitution, x andy 
denote subexpressions of/, which should contain only primed symbols, and ® is used as 
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an alternate symbol to represent the multiplication operation in the field F. The purpose of 

this step is to label as ® all of the original • operators occurring in the expression/, to 
distinguish them from the - operators that will be introduced into the transformed 
expression during the following steps of this method. 

(4) Transform the expression f 2 into the expression f 3 by replacing all occurrences of the 
source expression x~ l with the target expression x' 1 ■ r 2 . In this substitution, x denotes a 
subexpression of f 2 . 

(5) Transform the expression/, into the expression f 4 by replacing all occurrences of the 
source expression x ® y with the target expression x -y ■ r~' . In this substitution, x and y 
denote subexpressions of/}. 

(6) Transform the expression f 4 into the expression /' by replacing all occurrences of the 
source expression x ' with the target expression x- r. In this substitution, x ' denotes a 
primed variable or primed constant occurring in the expression f 3 , specifically excluding all 
instances of the unprimed constant r. The effect of this step is to replace every primed 
symbol with its unprimed form multiplied by r. 

Upon completion of the above steps, the expression /is transformed into a new expression 
/' The present invention has carefully specified the preceding steps in such a way as to ensure that 
f = /' f~ To prove this, the result is demonstrated for the four special cases when/ = x - y, f = 
x -y,f^ x -y, and/ = x~' , where x and y are elements in the field F The general result follows 
from the commutative, associative and distributive properties of the field. 

Case 1 Transformed Addition 

Let / - x - y Applying the substitution method of the present invention to the expression 
/results in the transformed expression f x ■ r y ■ r To see that / /' • note that/ x r 
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■= (x ■ y) ■ r ■ r~' = (x ■ r - y - r) ■ r~' f ■ r"' 
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Case 2 Transformed Subtraction 

Let/= x ~y Applying the substitution method of the present invention to the expression / 
results in the transformed expression /' - x ■ r -y ■ r To see that f = f ■ r~' , note that f=x-y = 
(x -y) r ■ r~' = (x r -y ■ r) ■ r~ l = f ■ r~' . 

Case 3 Transformed Multiplication 

Let/ - x -y Applying the substitution method of the present invention to the expression/ 
results in the transformed expression /' = (x -r) ■ (y ■ r) ■ r~ l . To see that/ = /' • r~ ! , note that / = 
x ■ y = x -y ■ r ■ r~ 2 = x -y ■ r ■ r ■ r~ ] ■ r~ ! = x - r ■ y ■ r ■ r~ ! ■ r~ ! = (x ■ r) ■ (y ■ r) ■ r~' ■ r~ ! = f ■ 
r' 1 . 

Case 4 Transformed Inversion 

Let/= x _/ . Applying the substitution method of the present invention to the expression/ 
results in the transformed expression /' = (x ■ r) ■ r To see that/ =/ r • r~\ note that / = x~ l ■ r 
■ r~ 2 = x' ! ■ r~' ■ r ■ r~ ! = (x ■ r) ■ r ■ r~ ! =/' ■ r~' . 

Thus, the present invention provides a method to transform any expression/ involving a 
finite number of field operations within a finite field F into the form /' • r~' . Furthermore, the 
expression/' • r' 1 constructed by the present invention is guaranteed to be in the Montgomery 
Canonical Form To verify this, note that (i) the substitution steps of the method of the present 
invention ensure that if the original expression /includes any subexpressions that are of the form x 
•>'. such subexpressions are transformed into the form fx ■ rj ■ (y ■ rj ■ /-"'', which is in the 
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Montgomery Canonical Form, and (ii) whenever the substitution steps of the method of the 

present invention introduce a new multiplication operation into the transformed expression, such 
operation brings with it a single additional operand which is always a power of r, thus preserving 
the Montgomery Canonical Form of the subexpression it is introduced into. 

Depending on the exact nature of F, and the number of the multiplication operations in the 
expression /and the exact number and nature of the operations involved in the calculation of/' 
computation of the expression f ■ r~ ! may be more efficient than direct computation of the 
expression /. This is particularly likely, when the field/ 7 is a member of either GF(p) or GF(2 k ). 
For, in such instances, the Montgomery Algorithm can be applied to the expression/' • r~ l to 
ensure optimized computation of the value that the expression / evaluates to 

Section G 

The present invention may also be used with "projective coordinates," which are used to 
eliminate the need for performing inversion. 

For example, in projective coordinates, a point on the elliptic curve group G has 3 
coordinate values: (x,, y h z t ) while the affine coordinates requires only two values: (x,, yjj. 

For example, for elliptic curves defined over GF(2 k ), given the distinct points P and O 
expressed in projective coordinates: 

P:=(x,,y lt z,) 

Q-(x 2 ,y 2 ,zi) 

the projective coordinates of the sum of 2 points on the elliptic curve are: 

P + Q: = (x 3 ,y 3 ,z 3 ) 
using the following addition rules. 



W ° 99/30458 PCT7US98/25824 

B = y 2 ■ z, - y, 

C = A + B 

D = A 2 ■ (A ~ a - z/) -i Zi ■ B - C 
x 3 = A ■ D 

y 3 = C -D + A 2 -(B -x, - A -yj 
z 3 = A 3 -z, 

This computation requires 13 field multiplications, and no inversions. 
Similarly, the addition formulae for computing 2P is given as. 
A =xj-z, 

B = h - z 4 ~ x, 4 
x 3 =A -B 

y 3 = x, 4 -A -r B ■ fx 2 ^yi-zi + A) 
Zi =A 3 

This computation requires 7 field multiplications, and no inversions. 

Thus, the use of projective coordinates eliminate the inversions at the expense of storing 3 
GF(2 k ) values to represent P and performing a few more multiplications. 

The present invention can also be used in conjunction with projective coordinates. The 
addition rules would then be modified as follows. 

A' = x 2 ' • Zj' ■ r~' + X/' 

B' ' = y 2 ' ' -z,' -r ! + y/ 

C r =A'+ B' 

D f =(A'-A / -r-')-(A'+a'-z/-r-') . r' ~r (zZ-B'-r' 1 ) -Cr^ 
X:/ - A'-D'-r' 

>'/- C'-D'-r-' - (A' ■ A' ■ r~ l ) ■ (B' ■ x, ' ■ r' ! A' -y/ ■ r~') ■ r~' 
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z/ = ((A' ■ A' ■ r~ l ) ■ A' ■ /■-'') -z,'- 1--' 

Similarly the rules for computing 2P are modified as 

A ' -= x, ' • z, ' ■ r-> 

B'= (((b'-zZ-r') -zj'-r' 1 ) -zZ-r' 1 ) -z,'-^ + ((x, ' - x, ' ■ r' 1 ) -x^-r' 1 ) -x/t -7 
5 x 3 '= A'-B'-r' 1 

y 3 '= (((xj ' ■ x, ' ■ r~') ■ x/ ■ r' 1 ) ■ x, ' ■ r~ l ) - A ' ■ r~' ->- 
B ' ■ (xi' ■ xj ' ■ r" 1 + y,' -z/ ■ r~ ! + A') ■ r~' 

IMPLEMENT A TION 

1 0 The present invention may be implemented on any conventional or general purpose PC 

; computer system. It may also be used in conjunction with any network system, including the 

Internet A preferred embodiment of a computer system for implementing this invention is an Intel 

Pentium II PC 233 MHz, running Windows NT 4.0. 

The present invention can be implemented in any programming language including C and 
15 Java. The following are examples of pseudo code suitable for implementing the present invention. 

Setup: a, b : Parameters of the elliptic curve (EC) 
F : The field upon which the EC is based 
Either GF{p) or GF(2 ,C ) 
field multiplication 
field addition 
field subtraction 
: field inversion 
P=(P(x), P(y)) : A point on the EC 
P(x) & P(y) are affine coordinates 

Algorithm Identifier: ExpPoint 



Input : e 



k-bit integer 

Point on the EC, P = (P(x), P (y) ) 

Point on the EC, Q = (Q(x) / Q(y)) 

eP = (P+P+...+P) (e times P) 



Output : Q 
Q 

function ExpPoint 
begin 

/* Transform P to P 1 using r */ 
P ' (x) = P (x) * r 
P' <y) = P(y) * r 

/* Start with O' point at infinity 
Q ' = O' 
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/* Binary method loop * 

for i=k-l downto 0 do 

Q' := DoublePoint (Q 
if e_i=l then Q ' : = 

/* Transform 

Q(x) = Q ' (x) 

Q(y) = Q* (y) 

return Q 
end 



PCT/US98/25824 



AddPoint {Q ' 
using r */ 



Algorithm Identifier: AddPoint 
. Input : 



Transformed Point on the EC 
Transformed Point on the EC 
Output: T' : Transformed Point on the EC 

Q 1 using the EC point addition rules 
function AddPoint 
begin 

/* If the underlying field is GF (p) 
lambda' = Multiply ( (Q ■ (y> - P'(y)) 
T' (x) = Multiply (lambda' , lambda 1 ) 
T ' (y) = Multiply (lambda • , (P'(x) - 
return T 

/* If the underlying field is GF(2 k ) 
lambda' = Multiply (CP' (y) + Q ■ (y) ) 
T ' (x) = Multiply (lambda' , lambda') 



*/ 

, Inverse 
- P' (x) - 
T' (x) ) ) - 



Q" (x) - 
Q ' (x) 
P' (y) 



*/ 

Inverse (P 1 
+ lambda' + 



(x) + Q ' 
P' (x) + 



(x) ) ) 
Q' (x) 



T' (y) = Multiply (lambda' , (P' (x) + T' (x> ) ) + T' (x) + P 1 (y) 



return T 
end 



Algorithm Identifier: DoublePoint 
Input: P ' : Transformed Point on the EC 
hi Output: T ' : Transformed Point on the EC 

SIP T» := P' + P using the EC point doubling rules 

function DoublePoint 
begin 

/* If the underlying field is GF(p) */ 
lambda' = Multiply (Multiply ( 3 P ' (x) , P ' (x) ) + a'), 
40 Inverse (2P ' (y) ) ) 

T' (x) = Multiply (lambda' , lambda') - 2P'(x) 

T' (y) = Multiply (lambda' , (P'(x) - T" (x) ) ) - P'(y) 

return T 

/* Else if the underlying field is GF (2 k ) */ 
45 T' (x) = Multiply (P' (x) , P'(x)) + 

Multiply (b', Multiply (Inverse <P' (x) , P'{x)))) 
T' (y) = Multiply (P- (x) , P'(x)) + 

Multiply (P ' (x) + Multiply (P 1 <y) , Inverse ( P • (x) )) , 
T' (x) ) + T' (x) 
5 0 return T 

end 



Algorithm Identifier: Inverse 
Input : u: Field element 
55 Output: t: Field element 
function Inverse 
begin 

t = u" 1 * r 2 
return t 
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end 
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Algorithm Identifier: Multiply 
Input : u, v: Field elements 
5 Output : t : Field element 
function Multiply 
begin 

t = u * v * r - "^ 
return t 
10 end 

A number of references describe the mathematical background for the present invention 
Those references include. P L. Montgomery, Modular multiplication without trial division, 
"Mathematics of Computation," 44(170):5 19-521, April 1985, D. E Knuth, "The Art of 

15 Computer Programming: Seminumerical Algorithms," volume 2, Second edition, Reading, MA. 

- ( Addison- Wesley, 1981; C. K. Koc and T. Acar, Montgomery multiplication in GF(2 k ), 

"Proceedings of Third Annual Workshop on Selected Areas in Cryptography," pages 95-106, 
Queen's University, Kingston, Ontario, Canada, August 15-16, 1996; C. K. Koc and T. Acar., 
Fast software exponentiation in GF(2 k ), "Proceedings, 13th Symposium on Computer 

2 0 Arithmetic," pages 225-231, Asilomar, California, July 6-9, 1997, Los Alamitos, CA: IEEE 

Computer Society Press; J. C. Bajard, L. S. Didier, and P Kornerup, An RNS Montgomery 
multiplication algorithm, "Proceedings, 13th Symposium on Computer Arithmetic," pages 
234-239, Asilomar, California, July 6-9, 1997, Los Alamitos, CA: IEEE Computer Society 
Press; D. R. Stinson. "Cryptography Theory and Practice," CRC Press, 1995; V. Miller, Uses of 
25 elliptic curves in cryptography, "Advances in Cryptology - CRYPTO 85, Proceedings," pages 
417-426, New York, NY. Springer- Verlag, 1985; N Koblitz, Elliptic curve cryptosystems, 
"Mathematics of Computation," 48 203-209, 1987; N Koblitz, "A Course in Number Theory and 
Cryptography," New York, NY Springer- Verlag, 1987, A. J. Menezes, "Elliptic Curve Public 
Key Cryptosystems," Boston, MA Kluwer Academic Publishers, 1993; R L Rivest, A Shamir, 

3 0 and L. Adleman. A Method for Obtaining Digital Signatures and Public-key Cryptosystems," 
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Communications of the ACM, 21(2). 120-126, 1978, T Beth, M Frisch, and G J Simmons, 

Public-key Cryptography State of the Art and Future Directions Springer- Verlag, NY, 1991, 
IEEE Working Group PI 363, Working Draft. IEEE 1363 Standard for RSA, Diffie-Hellman and 
Related Public-key Cryptography In preparation, 1995, RSA Laboratories, Answers to 
Frequently Asked Questions about Today's Cryptography. Version 3.0, 1996; G.B. Agnew, R C 
Mullin, I.M. Onyszchuk, and S.A Vanstone, An implementation of a fast public-key 
cryptosystem. Journal of Cryptology, 3(2):63-79, 1991 All of these publications are herein 
incorporated by reference as if each individual publication were specifically and individually set 
forth herein. 

Having described and illustrated the principles of our invention with reference to a 
preferred embodiment, it will be apparent that the invention can be modified in arrangement and 
detail without departing from such principles. As such, it should be recognized that the detailed 
embodiment is illustrative only and should not be taken as limiting the scope of our invention. 
Rather, we claim as our invention all such embodiments as may fall within the scope and spirit of 
the following claims and equivalents thereto. 
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We claim 

1 A method for producing an elliptic curve point multiplication product, 0 •= eP, using 
an arbitrary integer e, a point P on an elliptic curve group G defined over a field F, where G <=F 
x F, comprising the steps of 

constructing a set G' , 

constructing a mapping 7 from G into the set G \ constructing a mapping T } from G'onto 
G, and constructing an operation © defined on G\ such that (a) given P e G, T 1 ( T(P) J = P, and 
(b)P+P = r'(P'®P'), where = r^; 

producing an elliptic curve point multiplication product 0 by transforming the point P to 
the point P' using the mapping 7, performing the operation © on the point P' to determine the 
point 0'= eP', transforming the point O r to the product Q using the mapping T\ and 

using the product O in a cryptographic operation. 

2. The method of claim 1 wherein the set G, the set G' , the mapping T, the operation 
©, and the mapping T 1 are constructed such that given P,, P 2 , .... P.v e G, where Nis an integer, 
the computation of T 1 ( T(PJ © T(P 2 ) © © rfP. v ;; is more efficient than the computation of P t 
-Pi- - P.v. 

3 The method of claim 1 wherein: 

the mapping T is constructed by selecting any element r of the field F, and defining T as T: 
fx, y) -> (x ■ r, y ■ r), where P = (x, y) e G, and • is the multiplication operator in F; and 

the mapping T is constructed by defining T: (a,v) -> (it ■ r~ l , v • r~ ! ), where P' = (i/,v; & 

g: 
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4 The method of claim 3 wherein the field F is a member of GF(p). 



5 The method of claim 4 wherein the element r is selected as the smallest power of 2 
that is larger than p 

6. The method of claim 4 wherein the element r is selected as the product of prime 
numbers 

7 The method of claim 4 wherein the operation © is constructed such that the 
addition of two points in the set G'is given by- 
(xs \y 3 0 = (xi ',y, 0 ® (x 2 ',y 2 7 ; 

xs' ' = L' ' ■ L' ' • r~ ! —xi'-x 2 \ and 
y } '= L'- (xi'-x 3 0 -r' ! -y,'. 

8. The method of claim 4 wherein the operation © is constructed such that the 
doubling of a point in the set G'is given by 
(x l ',y l 0®(x 1 ',y,') = (x 3 \y } % 
z'= (y/+ yiT 1 -r 2 \ 

L' = ((x,'+ Xi'+x/J -x,' ■ r~ ! ~ a) - z'-r' 1 ; 
x 3 ' = L ' ■ L f ■ r~ l - X}'— X\ \ and 
y 3 '= L r ■ (Xi'-xs 1 ) ■)■"' -y, f . 
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9 The method of claim 4 wherein the Montgomery Algorithm m GF(p) is utilized to 

perform the operation © on the point P' to determine the point O' -= e P f 



10 The method of claim 3 wherein the field F is a member of GF(2 k ) 



1 1 The method of claim 10, wherein the operation © is constructed such that the 
addition of two points in the set G 'is given by 

(x 3 y 3 ') = (x,',yi r )®(x2',y2% 
z'= (x,'- x 2 r' -r\ 
5 L'=(y l '-y 2 ') ■ z'-r' 1 , 

x 3 ' = (L ' ■ L ' ■ r~ ! ) - L ' + X/ ' + x 2 ' ^ a '; and 
y 3 '= (L'-(x,'+ x 3 9 -r~') + x 3 't yi'. 

12. The method of claim 10, wherein the operation © is constructed such that the 
doubling of a point is given by 

(x ] \y i r )®(x 1 \y l r ) =(x 3 ',y 3 % 
z'= (x'0~' -r 2 , 
5 x 3 '= x, ' ■ x, r ■ r~ ! + (z' ■ z' ■ r' ! ) ■ b ■ r" 1 , and 

y 3 ' = x : ' -x,' -r~' + (xt'-r y,' -Z' -r~') -x 3 ' ■ r~' + x 3 r . 

13. The method of claim 10 wherein the element r is selected as x k modn(x), where 
n(x) is the irreducible polynomial generating the field GF(2 k ) 

14 The method of claim 10 wherein the Montgomery Algorithm in GF(2 k ) is utilized 



49 



WO 99/30458 PCT/US98/25824 

to perform the operation © on the point P' to determine the point O' - e P' 



1 5 The method of claim 1 wherein the step of performing the operation © on the 
point P' utilizes a binary method 

1 6 The method of claim 1 wherein the step of performing the operation © on the 
point P' utilizes an M-ary method. 

1 7 The method of claim 1 wherein the elements of sets G and G ' are implemented 
using Projective Coordinates. 

18. A method for optimizing the calculation of an expression / = f(x u .... x, , x„), 
wherein the expression /is comprised of a finite number of arbitrary field operations over any 
finite field F, and x, , x„ are all elements of F, comprising the steps of: 
selecting an element r, a constant, from the field F\ 

5 transforming the expression / -=f(x,, .... x, xj to the/' -- f'fai x,' x/) by 

replacing ail occurrences of x in the expression / with x ', giving/, where x 
denotes a variable or constant of / , 

replacing all occurrences of x- y in the expression / with x ® y, giving/, 
where x and y denote subexpressions of f ; ; 
10 replacing all occurrences of x~' in the expression f 2 with x~' ■ r, giving/, 

where x denotes a subexpression of /■; 

replacing all occurrences of x ® y in the expression/? with x ■ y ■ r' ! , 
giving/,, where x and y denote subexpressions of /, and 



50 



WO 99/30458 PCT/US98/25824 

replacing all occurrences of x ' in the expression f 4 with x ■ r, giving/ ', 

15 where x denotes a primed variable or primed constant in f 4 \ 

determining/ =/' • m~' ', and 

using /' • rrf ] to calculate/in a cryptographic operation 

19. The method of claim 1 8 wherein each instance ofx'-y'- m~' is computed using the 
Montgomery Algorithm when the set F is a member of GF(p) 

20. The method of claim 18 wherein each instance of x' ■ y' ■ m~~ l is computed using the 
Montgomery Algorithm in GF(2 k ) when the set F is a member of GF(2 k ) 

21 . A method for producing an elliptic curve point addition product, Q = P - P, using 
a point P on an elliptic curve group G defined over a field F, where G czF xF, comprising the 
steps of: 

constructing a set G'; 

5 constructing a mapping 7 from G into the set G ' constructing a mapping T l from G'onto 

G, and constructing an operation © defined on G'\ such that (a) given P e G, 7~Y T(P) ) = P, and 
(b) P+P = F'fP'® P% where P'= T(P); and 

producing an elliptic curve point addition product O by transforming the point P to the 
point P' using the mapping T, performing the operation © on the point P r and the point P' to 
10 determine the point 0\ transforming the point O' to the product Q using the mapping 7~ ; , and 
using the product O in a cryptographic operation 

22 A method for producing an elliptic curve point addition product. O P S, using 
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points P and S on an elliptic curve group G defined over a field F, where G czF x F, comprising 

the steps of. 

constructing a set G ' ; 

5 constructing a mapping Tfrom G into the set G' constructing a mapping T~' from G'onto 

G, and constructing an operation © defined on G' such that (a) given P e G, T~'( T(P) ) = P, and 
(b) P~S=T'(P'® S% where P'= T(P) and S' = T(S), and 

producing an elliptic curve point addition product 0 by transforming the point P to the 
point P' using the mapping T, by transforming the point S to the point S' using the mapping T, 
10 performing the operation © on the point P' and the point S' to determine the point Q\ 
transforming the point O' to the product O using the mapping T~'\ and 
using the product 0 in a cryptographic operation. 

23. Apparatus for producing an elliptic curve point multiplication product, O = eP, 
using an arbitrary integer e, a point P on an elliptic curve group G defined over a field F, where G 
czF xF, comprising. 

means for constructing a set G ' , 
5 means for constructing a mapping T from G into the set G ' constructing a mapping V 1 

from G'onto G, and constructing an operation © defined on G'; such that (a) given P e G, T l ( 
T(P) )=P, and (b) P+P = T ! (P'®P0, where P' = 7^; and 

means for producing an elliptic curve point multiplication product O by transforming the 
point P to the point P' using the mapping T, performing the operation © on the point P' to 
10 determine the point 0'= e P', transforming the point O' to the product 0 using the mapping 
T~ ! ; and 

means for using the product O in a cryptographic operation 
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